ishield-key-manager

MEDIUM

maintainer franga2000 0 votes scanned 2026-11-06 12:16:10.895151

View on AUR

Why flagged

Downloads a prebuilt binary zip from swissbit.com with a SKIP'd checksum, extracts and installs a prebuilt .deb (GUI binary) and a prebuilt CLI binary (iKMcli) - while the host appears to be the vendor's official domain, the SKIP'd checksum means any silent swap of the zip would go undetected and unverified binaries are executed/installed directly.

Triggered rules

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:14 source_x86_64=("https://www.swissbit.com/files/public/ikm/iShield_Key_Management_Kit_Linux.zip")

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Medium AI review llm_review

An AI model (anthropic/claude-sonnet-4.6) reviewed this and agrees it is MEDIUM (confidence 70%): Downloads a prebuilt binary zip from swissbit.com with a SKIP'd checksum, extracts and installs a prebuilt .deb (GUI binary) and a prebuilt CLI binary (iKMcli) - while the host appears to be the vendor's official domain, the SKIP'd checksum means any silent swap of the zip would go undetected and unverified binaries are executed/installed directly.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Miha Frangež <miha.aur@frangez.me>
    
      2pkgname=ishield-key-manager
    
      3pkgver=1.14.1
    
      4pkgrel=1
    
      5pkgdesc="Manage Your Swissbit iShield Key Devices: configure WebAuthn/FIDO2, TOTP, HOTP, PIV and other functions of your iShield Key."
    
      6arch=('x86_64')
    
      7url="https://community.swissbit.com/c/software-tools/download-links"
    
      8depends=('gtk3' 'libusb' 'systemd-libs')
    
      9optdepends=('libsecret')
    
      10options=('!strip' '!emptydirs')
    
      11source=('ishield-key-manager.sh' 'iKMcli.sh')
    
      12sha512sums=('570aa6e9a6b96fb89cbf37355a652bce172c4ae2a4a114793f0d5401d145ce1f8a0c457de349c6665369f35cf73ae637886a62ad1c3594e14a39be8c882c2feb'
    
      13            '31853e9779009cf7dd16afb45bff618ade02483a5757de7500be5c62a3713a2f8897859d88dac1f70d6a964df8b81da69f936bd440220dc55c14e6f56789b17a')
    
      14source_x86_64=("https://www.swissbit.com/files/public/ikm/iShield_Key_Management_Kit_Linux.zip")
    
      15sha512sums_x86_64=("SKIP")
    
      16
    
      17pkgver() {
    
      18	local v
    
      19	read -r v < "${srcdir}/iShield_Key_Management_Kit_Linux/version.txt"
    
      20	echo "${v#v}"
    
      21}
    
      22
    
      23package(){
    
      24	local kit="${srcdir}/iShield_Key_Management_Kit_Linux"
    
      25
    
      26	# Extract GUI package data from the deb
    
      27	ar x "${kit}/iKM/ishield-key-manager.deb"
    
      28	tar -xz -f data.tar.gz -C "${pkgdir}"
    
      29
    
      30	# GUI
    
      31	install -Dm755 "${srcdir}/ishield-key-manager.sh" "${pkgdir}/usr/bin/ishield-key-manager"
    
      32	sed -i 's/^Exec=.*/Exec=ishield-key-manager/' "${pkgdir}/usr/share/applications/com.swissbit.ishield-key-manager.desktop"
    
      33
    
      34	# CLI
    
      35	install -Dm755 "${kit}/iKMcli/iKMcli" "${pkgdir}/opt/ishield-key-manager/cli/iKMcli"
    
      36	install -Dm755 "${srcdir}/iKMcli.sh" "${pkgdir}/usr/bin/iKMcli"
    
      37	install -Dm644 "${kit}"/iKMcli/opensource-licenses/* -t "${pkgdir}/usr/share/licenses/${pkgname}/cli/"
    
      38	install -Dm644 "${kit}/LICENSE" -t "${pkgdir}/usr/share/licenses/${pkgname}/"
    
      39}
    
      40

Scan history

Scanned at (UTC)	Severity	Rules
2026-11-06 12:16:10	Medium	3
2026-11-06 12:12:41	Medium	3